> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarityq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# User Management and Roles

> Invite teammates, assign roles, and control who can do what across your workspaces.

User management is where you invite teammates to ClarityQ, set what each person can do, and remove access when someone leaves. It lives under **Organization Settings → User Management**.

Organization Settings is **Admin only**. No other role can open it.

## Inviting Users

If your organization signs in with **email/password or Google**, click **Invite User**. The wizard has two steps:

1. **User details** — their email, full name, and which workspaces they should have access to.
2. **Roles** — a default role for the person, and optional per-workspace overrides.

The invitee receives an email and is added to the organization once they accept.

If your organization uses **SSO**, the **Invite User** button is hidden — the **SSO Enabled** badge appears instead. New teammates are provisioned automatically the first time they sign in through your identity provider.

## Roles

Every user has an **org-wide role** that applies across all workspaces by default. You can override a user's role per workspace when their responsibilities differ in different parts of the business.

| Role | What it can do |
| - | - |
| **Admin** | Full control — manage users and roles, edit every catalog component, configure integrations, and use Ask Anything. |
| **Integration Manager** | Connect data warehouses and manage the Table Catalog. Cannot edit semantic components or chat. |
| **Analyst Contributor** | Read and write across all catalogs (Table, Event, Semantic), use Ask Anything, build dashboards and automations. |
| **Analyst** | Same as Analyst Contributor but **read-only** in the Semantic Catalog — useful when you want analysts to use definitions without editing them. |
| **Business User** | Read access to catalogs, full Ask Anything, dashboards, and automations. Cannot edit definitions. |

<Note>
  Roles are fixed — they can't be renamed or customized. If your organization needs a different mix of permissions, assign the closest fit or reach out for guidance.
</Note>

### Context Builder Access

Editing the Context Layer happens in the [Context Builder](/context-layer/building/how-the-context-layer-builder-works), which requires write access to the Semantic Catalog. By default the following roles can open the Builder, hold the lock, and deploy changes:

* **Admin**
* **Analyst Contributor**

**Analyst**, **Integration Manager**, and **Business User** can read the published Context Layer but can't open the Builder. Per-workspace overrides apply here too — a user can have Builder access in one workspace without having it across the org.

The Builder is also gated by a feature flag per workspace. If the **Context Builder** entry doesn't appear in your sidebar even though your role permits it, contact ClarityQ to enable it for the workspace.

## Per-Workspace Overrides

When a user's role differs between workspaces, edit their row and assign a per-workspace role. The User Management table shows **+N overrides** next to anyone with non-default roles in some workspaces.

You can also tick **+Integration Manager access** on a workspace to layer warehouse and Table Catalog management on top of whatever role they hold there.

<Note>
  **Admin** is an organization-level role and can't be overridden per workspace. An Admin is an Admin everywhere.
</Note>

## Removing Users

Deleting a user removes their access immediately. Their conversation history and private content are permanently deleted — there's no recovery.

### Transferring Their Dashboards

If the user owns public dashboards, the delete dialog tells you how many and offers to **transfer ownership** to someone else. Pick a person, or choose to delete the dashboards along with the user.

Transfer only covers dashboards the new owner can already access. Anything they can't access is transferred to **you** instead, so no dashboard is left without an owner. The dialog spells out the split before you confirm, and the confirmation tells you exactly what moved where.

<Warning>
  Everything else still cascades. The user's conversation history and their private dashboards and items are permanently deleted, whether or not you transfer their public dashboards. This can't be undone.
</Warning>

## API Keys

For programmatic access — for example, calling ClarityQ from your data pipeline — generate an API key under **Organization Settings → API**.

A key is scoped to a single workspace and works only with ClarityQ's public API endpoints, such as asking a question, reading conversations, and managing scheduled tasks. It does **not** carry the permissions of whoever created it, and it can't be used to reach the rest of the product.

Keys expire after a year by default, and each one has a daily prompt limit. From the API page you can see when a key was last used and how much it has consumed, change its limit, rotate it, or revoke it.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.